Virus Database

Puppets.960

Description Puppets.960

This is a relatively harmless memory resident parasitic virus. It hooks INT 9, 10h, and 21h, and writes itself to the end of COM- and EXE-files that are executed or opened.
When Alt-Ctrl-Del is pressed (warm rebooting), the virus tries to stay memory resident. It displays the following:
Phoenix ROM BIOS PLUS Version 5.23 08
Copyrigth (C) 1985-1988 Phoenix Technologies Ltd.
All Rights Reserved

then delays, calls INT 19h (bootstrap loader), gains control by INT 10h, and then hooks INT 9 and 21h.
While rebooting, if the system date is between January and October, the virus also displays the following message:
This virus written 1990. (C) Copyrigth The Master of Puppets
Public Domain Software.

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Greenpeace

Description Macro.Word.Greenpeace

It is an encrypted Word macro virus, it contains seven macros:
Documents NORMAL.DOT
FlSvvs FileSaveAs
FlSvv FileSave
AtExc AutoExec
FlOpvvv FileOpen
AutoOpen ImpRovevvvv5
TlsMcr ToolsMacro
FileExit FClccc

The virus infects the global macros area (NORMAL.DOT) on opening an infected document (AutoOpen) and writes itself to documents that are saved with new name (FileSaveAs).
On 22 May 1998 when Word is starting, the virus displays the MessageBox:
Belik Natasha demands:
Stop pollution of an environment!!!!!
Protect ozonian layer!!!
Rescue Volga!!!
Pay the salary!!!!!
GreenPeace Virus

If the author of document is "Igor Daniloff", the virus replaces the AutoOpen and IDRWEBSCAN macros with harmless ones: new AutoOpen displays the MessageBox:
In the WinWord6.0/7.0rus environment
the viruses are not distributed
DrWeb for WinWord

IDRWEBSCAN is replaced with do-nothing macro.
On entering the "Tools/Macro" menu the virus sets the document password protection (password="orhey"), and resets it after leaving "Tools/Macro".

Macro.Word.Grunt

Description Macro.Word.Grunt

This is an encrypted virus. It contains two macros: XxGRUNTxX1 and XxGRUNTxX2. Because this virus has no auto-macros, it takes control by assigning the 'E' key to "XxGRUNT1xX1" macro, and the 'I' key to "XxGRUNTxX2" macro, i.e. when 'E' or 'I' keys are pressed, corresponding macro takes control. MS Word saves these redirections in documents, and these keys are automatically assigned with macros when Word is opening an infected document or global macros.
The virus does not manifest itself. It contains the string:
A Virus from Nightmare Joker's Demolition Kit!

Home